Amazon account hacked

[Buddy Bradley]

Woke up this morning to find my wife's Amazon account has been hacked. They'd changed her name, email and password, and ordered a bunch of what looks like electronics off amazon.ca. Luckily they hadn't thought to set up 2FA, so since her phone app was still logged in I set that up, and have been getting authentication pings all morning.

Bank has stopped the transactions, so don't think we'll lose any money, but it's still annoying as hell. The weird thing is that yesterday she got a new Fire Tablet, so set it up and signed in with her Amazon account. Seems like a bit of a coincidence that a few hours later, her Amazon password has leaked and her account compromised...

 

[editor]

Woke up this morning to find my wife's Amazon account has been hacked. They'd changed her name, email and password, and ordered a bunch of what looks like electronics off amazon.ca. Luckily they hadn't thought to set up 2FA, so since her phone app was still logged in I set that up, and have been getting authentication pings all morning.

Bank has stopped the transactions, so don't think we'll lose any money, but it's still annoying as hell. The weird thing is that yesterday she got a new Fire Tablet, so set it up and signed in with her Amazon account. Seems like a bit of a coincidence that a few hours later, her Amazon password has leaked and her account compromised...

That does suck but at least you were saved by 2FA! Did the buy the tablet new?

 

[Buddy Bradley]

Did the buy the tablet new?

Yes, from Argos. Probably just one of those weird coincidences.

 

[Shippou-Sensei]

This made me put 2 factor authentication on my account.

 

[mauvais]

Same. My Amazon password has actually been a single, dictionary word on the 'most frequently used passwords' list since I set it up in about 2001, so I changed it

 

[yield]

Me too.

 

[8ball]

I need to remember to do something with mine...

 

[Buddy Bradley]

This made me put 2 factor authentication on my account.

The critical problem with 2FA is that aside from a few outliers that let you use an app like Google Authenticator, it's mostly done via SMS - which means if you live in a mobile blackspot, like we do, it's completely useless. My wife gets no reception on her phone at home at all. (Thanks, Tesco Mobile, you suck.)

 

[Throbbing Angel]

Sorry to hear that Buddy Bradley - this has made me switch on 2SV too - I already use Google Authenticator so I've set it up on there too - either way - if I lose my mobile I'm screwed

 

[strung out]

The critical problem with 2FA is that aside from a few outliers that let you use an app like Google Authenticator, it's mostly done via SMS - which means if you live in a mobile blackspot, like we do, it's completely useless. My wife gets no reception on her phone at home at all. (Thanks, Tesco Mobile, you suck.)

Two factor authentication when using SMS doesn't provide any extra protection when your phone number gets hijacked as happened to my wife last year. It ended up being a right pain to sort out as the person hijacking my wife's accounts had access to all the SMSs she was receiving to reset passwords etc.

Good article about it all here:

TechCrunch is now a part of Verizon Media

techcrunch.com

 

[chainsawjob]

Woke up this morning to emails saying Welcome to Amazon Prime (which I haven't signed up for), and details of an order placed at 3am, plus an email saying payment declined.

I assume it's not coming now since the payment has been declined? Although it's still listed as being due for delivery tomorrow.

I haven't used my Amazon account for over 5 yrs, I boycott them now. It still has my old address details in from where I lived 5 years ago.

I don't get it. There's a new bank card associated with the account which isn't mine. Why would someone hack my account and order something that it says is being delivered to my address, and use their own bank card, not mine? I can't remember if I had card details saved (I tend to never save them, but can't remember if I was doing that 5+ yrs ago), but if I did it would probably be for a card that's since expired. And why would they not change the delivery address?

I've changed my password to a stronger one. Added my phone number for 2 step authentification (it now sends me a text). Was I right to do that? Does the hacker now have access to my phone number?

Am I safe to now just close my Amazon account, since I don't want it?

Thanks.

 

[Buddy Bradley]

chainsawjob - If your own bank details weren't there, it's probably also a stolen credit card. They make a test purchase with it to your address just to check it works, then they'll update the delivery address and order more expensive things they can flip.

If they still had access to your account, they would be able to see your phone number, but if you changed the password you should be okay. But if you're not using it at all, you might as well just close it. Report the transaction as fraud first, though, or you'll keep getting chased for non-payment by the sellers that have been ripped off too.

 

[chainsawjob]

Ah, that makes sense, a stolen credit card which has perhaps already been reported stolen and the payment was therefore rejected? And making a test purchase first before subsequently changing the address. I see.

Ok, I'll report it as fraudulent first and then close my account.

Cheers Buddy Bradley

 

[chainsawjob]

Hmm, trying to report it as fraudulent doesn't seem possible. It only gives you pre-set options to select (there's no option to type in your own words), and fraud isn't one of them. The nearest is phishing or scam enquiries, and then the only further options are 'Request for payment outside Amazon site' or 'Request for payment using Amazon Gift Cards off Amazon site'. Neither of these apply. There's no option for 'I didn't make this purchase, it's fraudulent, and my account's been hacked'. Useless

I followed the advice here Amazon.com Help: Report a Security Issue and then clicked on Contact Customer Service which took me to the contact form here https://www.amazon.com/gp/help/customer/contact-us/

Or am I missing something?

 

[platinumsage]

Same. My Amazon password has actually been a single, dictionary word on the 'most frequently used passwords' list since I set it up in about 2001, so I changed it

My Amazon password was "blue" until two years ago. I chose it back in 1998.

 

[Supine]

The critical problem with 2FA is that aside from a few outliers that let you use an app like Google Authenticator, it's mostly done via SMS - which means if you live in a mobile blackspot, like we do, it's completely useless. My wife gets no reception on her phone at home at all. (Thanks, Tesco Mobile, you suck.)

I just set up 2FA on amazon. There was another option if you didn’t have sms capability.

 

[tommers]

Hmm, trying to report it as fraudulent doesn't seem possible. It only gives you pre-set options to select (there's no option to type in your own words), and fraud isn't one of them. The nearest is phishing or scam enquiries, and then the only further options are 'Request for payment outside Amazon site' or 'Request for payment using Amazon Gift Cards off Amazon site'. Neither of these apply. There's no option for 'I didn't make this purchase, it's fraudulent, and my account's been hacked'. Useless

I followed the advice here Amazon.com Help: Report a Security Issue and then clicked on Contact Customer Service which took me to the contact form here https://www.amazon.com/gp/help/customer/contact-us/

Or am I missing something?

There is a way to speak to somebody there but it's hidden away in the options. I'm not at a computer atm but I'll see if i can find it later.

My wife had somebody set up a spotify account in her name last night using a password that she has used before. So she's changed that on everything that is important. I guess they test that the combination of email address and password works (she got an alert and changed the password, which i guess is what they want you to do). Somebody somewhere must have had a data breach that she wasn't told about.

Google had a list of websites with "compromised passwords" but you have to go into the security menu to see them. Surely that should be in big flashing letters whenever you access their site?

 

[Buddy Bradley]

Google had a list of websites with "compromised passwords" but you have to go into the security menu to see them. Surely that should be in big flashing letters whenever you access their site?

You can check if your email is included in any hacked dumps of user details on this site:

https://haveibeenpwned.com/

 

[chainsawjob]

Hmm, trying to report it as fraudulent doesn't seem possible. It only gives you pre-set options to select (there's no option to type in your own words), and fraud isn't one of them. The nearest is phishing or scam enquiries, and then the only further options are 'Request for payment outside Amazon site' or 'Request for payment using Amazon Gift Cards off Amazon site'. Neither of these apply. There's no option for 'I didn't make this purchase, it's fraudulent, and my account's been hacked'. Useless

I followed the advice here Amazon.com Help: Report a Security Issue and then clicked on Contact Customer Service which took me to the contact form here https://www.amazon.com/gp/help/customer/contact-us/

Or am I missing something?

Doh, I was using .com instead of .co.uk

I found a chat facility to 'speak' to a real human (I think they were anyway). So I've reported the fraud, and they've passed it on to their Accounts section, I think, who should get back to me within 24-48 hrs. After that I'll close my account. I changed the password again to be on the safe side.

You can check if your email is included in any hacked dumps of user details on this site:

https://haveibeenpwned.com/

Thanks, done that and I'm not on it thankfully.

 

[chainsawjob]

Google had a list of websites with "compromised passwords" but you have to go into the security menu to see them. Surely that should be in big flashing letters whenever you access their site?

Thanks, that sounds worth taking a look at. I'm having to change a bunch of passwords too, like your wife. There are various less important things that I use the same password for, but I guess it would be sensible to change them all the same. I might look into one of those password wallets, or a random password generator or something. I'm a bit rubbish at thinking up passwords, and too reluctant/lazy to change them very often!

 

[Buddy Bradley]

Thanks, that sounds worth taking a look at. I'm having to change a bunch of passwords too, like your wife. There are various less important things that I use the same password for, but I guess it would be sensible to change them all the same. I might look into one of those password wallets, or a random password generator or something. I'm a bit rubbish at thinking up passwords, and too reluctant/lazy to change them very often!

1Password is the usual recommendation. An alternative strategy is to choose a pattern that you use for every site that incorporates the site name - so maybe "chainsawamazon123" or whatever - which means you can easily remember each password, but don't have any password used for multiple sites.

 

[kebabking]

I got a poorly worded email this morning to tell me that my Amazon account had been locked, and giving me a login button to press.

I don't have an Amazon account, and if I did I'd expect them to know my name, so I didn't take advantage of their kind offer....

 

[tommers]

Thanks, that sounds worth taking a look at. I'm having to change a bunch of passwords too, like your wife. There are various less important things that I use the same password for, but I guess it would be sensible to change them all the same. I might look into one of those password wallets, or a random password generator or something. I'm a bit rubbish at thinking up passwords, and too reluctant/lazy to change them very often!

Google should suggest a random strong password when you change it and that is then stored in chrome (if you use it)

 

[two sheds]

... or Firefox (if you use it).

 

[Spymaster]

Same. My Amazon password has actually been a single, dictionary word on the 'most frequently used passwords' list since I set it up in about 2001, so I changed it

What was it?

 

[tommers]

What was it?

Passw0rd

 

[keybored]

You can check if your email is included in any hacked dumps of user details on this site:

https://haveibeenpwned.com/

Their password databases are a useful eye-opener too.

Have I Been Pwned: Pwned Passwords

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

 

[Plumdaff]

I have an ongoing, years long problem with an American woman who must have the same name as me who periodically sets up to have bills and so on sent to my email address. It's remarkably difficult to convince people, especially when all I get are emails saying "Log in to see your bill" so I don't actually know her address, phone number etc. that I'm not that person. So far this year a US mobile phone company has been very helpful and sorted it, but a hotel chain rewards programme won't do anything.

 

[mauvais]

What was it?

Passw0rd

Much too secure.

'monkey'

 

[Pickman's model]

I have an ongoing, years long problem with an American woman who must have the same name as me who periodically sets up to have bills and so on sent to my email address. It's remarkably difficult to convince people, especially when all I get are emails saying "Log in to see your bill" so I don't actually know her address, phone number etc. that I'm not that person. So far this year a US mobile phone company has been very helpful and sorted it, but a hotel chain rewards programme won't do anything.

Every year I get 'renew your journal subscription' emails from a well-known university press who I have bought a couple of books from using my work email address. Only these renew emails are for the library journal renewals and no amount of saying they shouldn't be emailing me has worked. So I just forward them.